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Executive Summary 

State University of New York College at Brockport 
Selected Financial Management Practices 



Scope of Audit The State University of New York College at Brockport (SUNY 

Brockport) offers programs in arts, humanities, social sciences, sciences 
and professional studies at both the baccalaureate and masters levels. 
During the year ended March 31, 1994, SUNY Brockport collected more 
than $37 million in revenues and made disbursements totaling $11.4 
million. SUNY Brockport reports an equipment inventory of nearly 
9,000 items valued at $16 million. 

Our audit addressed the following questions about SUNY Brockport’ s 
internal controls over cash and equipment: 

• Do the controls provide adequate assurance that all cash collec- 
tions are deposited into authorized bank accounts and all cash 
disbursements are authorized? 

• Do the controls provide adequate assurance that equipment is 
safeguarded against loss and theft? 



Audit Observations We found that improvements are needed in SUNY Brockport’s internal 

and Conclusions controls over cash collections, cash disbursements, and equipment 

inventories. 

The SUNY Brockport Bursar’s Office collects tuition and other student 
charges which comprise most of the college’s revenue. A goal of the 
Bursar’s Office is to provide students with a single location for resolving 
collection matters. To help achieve this goal, the Bursar’s Office 
permits several staff to both access cash and use computerized systems 
to adjust student charges. To compensate for the control risk that results 
from this lack of separation of duties, the Bursar’s Office relies on 
management’s review of computer reports of account adjustments. 
However, we found no documentation that these reviews are regularly 
performed. This control weakness needs to be corrected. We further 
recommended that SUNY Brockport minimize the number of Bursar’s 
Office employees who handle cash and also have the capability to change 
charges. (See pp. 3-5) 

We also identified weaknesses in cash controls at locations outside the 
Bursar’s Office. At some locations, press-numbered cash receipts are not 
issued and cash deposits are not independently reconciled to records of 
cash receipt. At one such location, we could not account for an 
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estimated $1,800 in fees collected over a one-year period. Moreover, 
contrary to requirements, the cash collected at this location was not 
deposited into an authorized State bank account and account records did 
not indicate how disbursements of $2,3?0 were used. We recommended 
that SUNY Brockport officials take steps to ensure that all fees are 
properly deposited and accounted for. (See pp. 7-9) 

Cash disbursements made by SUNY Brockport include refund transac- 
tions to students resulting from changes in enrollment status and 
exchange transactions which occur when funds from loans, scholarships 
and financial aid exceed a student’s bill. We found that refund and 
exchange checks are issued by cashiers without an independent review 
by any other employee. Because of this weakness, unauthorized 
disbursements are less likely to be prevented. We recommended that an 
independent review take place prior to the release of a check. (See p. 
6) 

SUNY Brockport is required to annually compare equipment inventory 
records to the equipment on hand to ensure that all the equipment owned 
by the college can be accounted for. We found that, while such a 
procedure is performed, improvements are needed in the procedure to 
ensure that it is effective. We selected 126 items listed on the inventory 
records for verification, but were unable to locate 14 of these items with 
a total value of $19,173, including three computers and two printers. 
Also, during the year ended March 31, 1994, SUNY Brockport removed 
$190,000 of equipment from its inventory records because the equipment 
could not be accounted for. One department alone lost 105 items in the 
interval between annual inventories, including $115,000 in computer 
equipment. We made several recommendations to improve controls over 
equipment. (See pp. 11-13) 


Comments of 
SUNY Officials 


SUNY officials believe that existing controls are adequate in that they 
represent the best efforts of SUNY Brockport to provide services to their 
students with available resources. They do recognize that improvements 
are needed over cash collections at peripheral sites and indicate they have 
already made progress toward this end. 
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Introduction 



Xhe State University of New York College at Brockport (SUNY 
Brockport) is a college of arts and sciences which offers programs in 
arts, humanities, social sciences, sciences and professional studies at both 
the baccalaureate and masters levels. In addition, SUNY Brockport 
offers certificate programs in selected professional areas. SUNY 
Brockport became part of the State University of New York (SUNY) in 
1948 and is simated on a 591-acre tract in the Village of Brockport. 
which is located about 16 miles west of Rochester. 

During the 1993-94 academic year, SUNY Brockport reported an average 
enrollment of about 6,900 undergraduates and 1,800 graduate smdents. 
SUNY Brockport’s operating expendimres for the 1993-94 fiscal year 
totaled approximately $53.6 million, including $38 million in personal 
service costs for 1,200 employees. During that period, SUNY Brockport 
collected more than $37 million in revenues and made disbursements 
totaling $11.4 million. SUNY Brockport reports an equipment inventory 
of nearly 9,000 items valued at $16 million. 



Audit Scope, 
Objectives and 
Methodology 



We audited selected SUNY Brockport fmancial management practices for 
the period April 1. 1992 through November 30, 1994. The objectives 
of our audit were to determine whether SUNY Brockport instimted an 
adequate system of internal controls over the funds received and 
disbursed, as well as over equipment assets to prevent their loss or theft. 
To accomplish our objectives, we reviewed SUNY Brockport’s policies 
and procedures, applicable rules and regulations, and appropriate 
documentation. We also interviewed SUNY Brockport management and 
staff. 

We conducted our audit in accordance with generally accepted govern- 
ment auditing standards. Such standards require that we plan and 
perform our audit to adequately assess those operations of SUNY 
Brockport which are included within our audit scope. These standards 
require that we review and report on SUNY Brockport’s internal control 
strucmre and its compliance with those laws, rules and regulations that 
are relevant to those operations that are included in our audit scope. An 
audit includes examining, on a test basis, evidence supporting transac- 
tions recorded in the accounting and operating records and applying such 
other auditing procedures as we consider necessary in the circumstances. 
An audit also includes assessing the estimates, judgments, and decisions 
made by management. We believe that our audit provides a reasonable 
basis for our findings, conclusions and recommendations. 
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We use a risk-based approach when selecting activities to be audited. 
This approach focuses our audit efforts on those operations that have 
been identified through a preliminary survey as having the greatest 
probability of needing improvement. Consequently, by design, finite 
audit resources are used to identify where and how improvements can be 
made. Thus, little audit effort is devoted to reviewing operations that 
may be relatively efficient and effective. As a result, our audit reports 
are prepared on an "exception basis." This report, therefore, highlights 
those areas needing improvement and does not address activities that may 
be functioning properly. 


Internal Control 
and Compliance 
Summary 


'Ve identified significant weaknesses in the internal controls relating to 
c. :h collections and disbursements and equipment inventories. These 
weaknesses are described in the sections of this report entitled "Bursar’s 
Office Cash Controls." "Peripheral Cash Collection Controls," and 
"Equipment Controls." We identified no significant instances of 
noncompliance with relevant laws, rules and regulations. 


Response of SUNY 
Ofndals to Audit 


A draft copy of this report was provided to SUNY officials for their 
review and comment. Their comments have been considered in 
preparing this report and are included as Appendix B. 

Within 90 days after final release of this report, as required by Section 
170 of the Executive Law, the Chancellor of the State University of New 
York shall report to the Governor, the State Comptroller, and the leaders 
of the Legislature and fiscal committees, advising what steps were taken 
to im.plement the recommendations contained herein, and where 
recommendations were not implemented, the reasons therefor. 



Bursar’s Office Cash Controls 





At SUNY Brockport, the Bursar’s Office is the primary cash receipt 
location. The Bursar’s Office processes all student payments and 
receives funds transferred from other campus cash collection locations. 
During the fiscal year ended March 31, 1994, SUNY Brockport 
deposited over $37 million in its general bank account. The Bursar’s 
Office processed most of these funds. 

In addition to processing cash receipts, the Bursar’s Office also processes 
cash disbursements associated with student accounts. These disburse- 
ments include refunds resulting from changes in student enrollment status 
and the application of financial aid, loans and scholarships to student 
accounts. During the fiscal year ended March 31, 1994, the Bursar’s 
Office issued checks totaling $11.4 million. 

SUNY Brockport management has a responsibility to establish an 
effective internal control system over cash received and disbursed. We 
reviewed the internal control system over cash receipts and disbursements 
used at the Bursar’s Office and found that improvements are needed in 
this system. 


Cash Receipt 
Controls 


An effective internal control system provides reasonable assurance that 
all cash which should be received is actually received and is promptly 
recorded and deposited. In order to provide this assurance, duties 
related to the handling of cash should be separated from duties related 
to the recording of receipts. This control feature helps to prevent 
employees from misappropriating cash and adjusting the related 
accounting records. 

However, we found that some employees who have access to the 
accounting records also handle cash. For example; 

• Ten employees in the Bursar’s Office with accounting duties have 

the ability to use the computer to make changes to the charges 
for tuition, rooms and meals. At some point during the year, 
most of these employees fill in for cashiers and therefore handle 
checks and currency while having the capability to change 
charges. 



• An employee in the Financial Aid Office, the Bursar’s Office 
secretary, and several computer programmers have the ability to 
use, the computer to change charges for tuition, rooms and meals. 
We believe these employees do not need this capability to 
perform their duties. Moreover, because the Bursar’s Office 
secretary processes mail, she has access to all the checks received 
through the mail while also having the ability to change charges. 

• The manager of the Bursar’s Office can also use the computer to 
change student charges. While such capability is appropriate for 
the manager, she also handles cash because she prepares the cash 
collections for deposit into the bank. 

• The three cashiers in the Bursar’s Office also have the capability 
to use the computer to adjust the amounts recorded for health 
fees, for alumni fees, and for several miscellaneous charges. 

SUNY Brockport officials told us that, as part of their overall efforts to 
improve the efficiency of Bursar’s Office operations and better meet the 
needs of students, all Bursar’s Office employees are given the capability 
to change student charges. Differing levels of such capability are 
assigned to employees based on their specific duties. However, we 
believe that SUNY Brockport officials should reevaluate this decision. 
The greater the number of employees who can change student charges, 
and also handle cash, the greater the likelihood that accounts can be 
improperly adjusted without detection. 

A large portion of the cash received by the Bursar’s Office arrives 
through the mail. Cash received through the mail should be recorded as 
soon as the mail is opened, and the recording should be done by 
someone who handles no other cash and has access to no accounting 
records. Further, the cash should be recorded before the funds are 
turned over to cashiers for processing. These procedures reduce the risk 
that unrecorded receipts can be diverted. 

However, the Bursar’s Office does not make a record of cash received 
in the mail and regularly turns unrecorded funds over to cashiers for 
processing. Therefore, SUNY Brockport risks the diversion of 
unrecorded receipts. Our prior audit at SUNY Brockport (Report 89-S- 
58), issued in May 1990, pointed out this control weakness. However, 
SUNY Brockport management did not correct this weakness as recom- 
mended by the prior report. SUNY Brockport officials have indicated 
to us that they plan to correct this weakness by instituting a lockbox 
system in which payments are sent directly to a bank. 



Accounting records must sometimes be adjusted to correct for errors. 
These adjustments must be carefully controlled to prevent unauthorized 
adjustments. Therefore, all account adjustments should be independently 
reviewed by management to ensure that they are authorized and 
otherwise appropriate. 

SUNY Brockport officials told us that adjustments to the accounting 
records are summarized in a separate record and made available to 
independent managers. However, we found no documentation that these 
adjustments are regularly reviewed. As a result, unauthorized and 
otherwise inappropriate adjustments are less likely to be detected. SUNY 
officials indicated that adjustments are regularly reviewed and that 
procedures will be instituted to document them. 

During our audit, we found that cashiers in the Bursar’s Office also 
made adjustments to the accounting records that had the effect of 
reducing the amount of cash recorded as received without establishing 
corresponding accounts receivable. Until we brought this matter to the 
attention of SUNY Brockport officials, they were unaware of the 
increased control risks created by the use of this function. The officials 
have since denied the cashiers access to this computer function (which 
is called the cash-back function). However, improvements are still 
needed m the procedures used to review account adjustments. We noted 
that the separate record of account adjustments is not detailed enough to 
permit as thorough a review as is needed. 



Recommendations 

1. Assign capability to change charges only to those employees 
who need such capability to perform their duties. 

2. Minimize the number of employees who handle cash and also 
have the capability to change charges; and concurrently 
strengthen the independent review of account adjustments. 

3. Make a record of the cash that is received in the mail as soon 
as the mail is opened and before the funds are given to the 
cashiers for processing. 
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Disbursement 

Controls 



Cash disbursements made by SUNY Brockport include refund transac- 
tions to students resulting from changes in enrollment status and 
exchange transrctions which occur when funds from loans, scholarships 
and financial aid exceed a student’s bill. If cash disbursements are to 
be adequately controlled, they should not be made by individuals who 
also collect cash or have access to the related accounting records. In 
addition, checks should not be issued without an independent review of 
the supporting documentation. 

At SUNY Brockport, cash disbursements can be made by any employee 
in the Bursar’s Office, including the three cashiers. Moreover, the 
employees in the Bursar’s Office handle cash and have the capability to 
change student charges. When a student is due a refund, the Bursar and 
other authorized employees approve the refund transaction. However, 
the employee who is acting as cashier routinely prepares the check using 
the check signing machine. The check is not reviewed by any other 
employee to ensure that the payment is appropriate. As a result of this 
control weakness, unauthorized disbursements are less likely to be 
prevented. 

SUNY Brockport officials believe that their current practices provide 
reasonable assurance that check disbursements are properly authorized 
and processed. We are concerned that the approval takes place before 
the checks are prepared and the cashier who prepares the check has the 
capability to change student charges. We continue to recommend that 
checks be independently reviewed after they are prepared and befc.e they 
are distributed. 



Recommendations 

4. Ensure that employees who make cash disbursements do not 
handle cash collections or have the capability to change student 
charges. 

5. Independently review checks against supporting documentation 
before distributing the checks. 
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Peripheral Cash Collection Controls 



Cash on college campuses is also collected at sites other than the 
Bursar’s Office. During 1993, we audited cash collection controls at 
such peripheral sites on selected campuses throughout the SUNY system 
(Report 94-S-27), including five peripheral cash collection locations at 
SUNY Brockport. We identified control weaknesses at each’ SUNY 
Brockport location reviewed. 

We interviewed SUNY Brockport officials to determine whether SUNY 
Brockport has taken action to improve cash collection controls on 
campus, particularly at the five locations mentioned in the prior report. 
We found that SUNY Brockport has taken positive steps to improve 
controls, including realigning internal control responsibilities, establishing 
an internal audit function, and taking a survey to identify all peripheral 
cash collection locations. In addition, SUNY Brockport issued a 
directive to campus cash managers outlining minimum cash control 
requirements. Each cash collection location was to implement the 
directive’s requirements by August 1, 1994. 

At the time of this audit, SUNY Brockport was in the process of 
evaluating controls at the five locations mentioned in the prior report. 
Accordingly, we did not include these locations in this audit. Instead, 
we audited cash collection controls at five other peripheral locations. 
Our intention was to verify that each location has appropriate cash 
controls and to determine the extent to which the locations have 
implemented the requirements of the administrative directive. 

Our review showed that, while most cash managers are aware of the 
directive and its requirements, little is being done to implement the 
directive’s requirements. We found that four of the five locations that 
we reviewed still do not have appropriate cash controls. We also found 
that SUNY Brockport has not identified all of the campus locations that 
collect cash. As a result, SUNY Brockport has limited assurance that 
cash managers at peripheral locations properly record and deposit all 
cash collected. In fact, at one location, we could not account for all of 
the cash that should have been collected. 

During the year ended June 30, 1994, cash collections of $731,832 were 
reported by the five locations that we examined. The collections ranged 
from $1,894 at one location to $313,069 at another. The five locations 
collected payments made for examination fees, theater tickets, health 
insurance premiums, services provided by SUNY Brockport in support 
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of outside grants, and other miscellaneous services provided by SUNY 
Brockport. 

In order to provide reasonable assurance that all the cash received at a 
location is deposited in the bank, press-numbered receipts should be 
issued to each person who makes a payment. In addition, the cash 
deposited in the bank should be reconciled to the records of the cash 
received by someone independent of the cash collection process. 

We found that the cash collection controls are adequate at one of the five 
locations we examined. This location reported collections of $250,662 
during the year ended June 30, 1994. However, at three of the other 
four locations, press-numbered cash receipts are not issued, and such 
receipts are not always issued at the fourth location. At all four 
locations, cash deposits are not independently reconciled to records of 
cash receipt. 

In addition, cash processing duties are not adequately separated at one 
location, as a single employee receives payments, deposits the payments 
in the bank, and maintains records of the payments received. The work 
of this employee is not verified by anyone else. During the year ended 
June 30, 1994, $77,944 in health insurance premiums was reportedly 
collected by this employee. 

Controls were especially weak at one location. At this location, 

individuals were charged $25 for taking examinations. During the year 
ended June 30, 1994, $1,894 in examination fees was reportedly paid. 
According to SUNY guidelines, such payments should be deposited into 
a State account. However, these payments were deposited in a bank 
account that was not autliorized by the State. We reviewed the 

transactions in this account and found that the funds were used to cover 
the costs of administering the examinations, as well as to purchase 
refreshments, equipment and supplies. Moreover, account records did 
not indicate the purposes of disbursements of $2,329 made between 
January 2, 1991 and March 9, 1994. 

We further found that the staff at the above location did not make any 
deposits between October 10, 1991 and October 4, 1992. According to 
the relevant records, during this period examinations were given to 72 
people. Some of these examination fees may have been deposited after 
October 1992, but we estimate that as much as $1,800 in fees was not 
deposited. 



When we reported our findings about this account to SUNY Brockport 
officials, they told us they would take control of the funds and suspend 
the examination fees until a proper course of action could be determined. 

If cash collections on campus are to be effectively controlled, each cash 
collection location must be identified. In 1994, SUNY Brockport 
officials conducted a survey of the campus and identified 25 locations 
where cash is collected. However, four of the five locations that we 
examined, as well as at least three other cash collection locations, were 
not identified by this survey. (SUNY Brockport officials indicate they 
are addressing these control weaknesses.) 



Recommendations 

6. Ensure that press-numbered receipts are issued whenever cash 
is collected. 

7. Ensure that all cash deposits are reconciled to the records of 
cash received by someone independent of the cash collection 
process. 

8. Deposit the examination fees into an authorized State account. 

9. Assure that examination fees are properly deposited and 
accounted for. 

10. Ensure that all cash collection locations have been identified. 



Equipment Controls 





SUNY Brockport reports an equipment inventory of nearly 9,000 items 
valued at $16 million. SUNY Brockport maintains its equipment records 
on SUNY’s computerized Property Control System. Our review showed 
that SUNY Brockport must improve controls over equipment to better 
safeguard the equipment against loss or theft. 


Independent 
Annual Inventory 


Guidelines published by the Office of the State Comptroller (OSC) and 
SUNY require campuses to complete independent annual inventories. 
While SUNY Brockport does conduct annual inventories, improvements 
are needed in certain aspects of these inventories, such as their 
independence, to ensure that they are effective. 

For example, since 1993 SUNY Brockport has relied on each department 
to verify its own inventory with independent follow-up by the Property 
Control Office. However, we found that these follow-up reviews are not 
timely: as of November 30, 1994, the Property Control Office had 
followed up on the annual inventories of only 9 of the approximately 100 
departments. In addition, these reviews included only a limited number 
of items at each department and were not expanded even when a high 
percentage of items were missing in a department. Therefore, we 
believe that SUNY Brockport’s follow-up reviews are of limited value in 
controlling the equipment inventory. 

We also noted that, as of November 30, 1994, 17 departments had yet 
to certify their 1994 equipment inventories, which should have been 
certified by May 1994, and 23 other departments did not make any 
changes when they certified their 1994 inventories. In order to test 
whether the equipment at these 40 departments was accurately recorded 
on the inventory records, we judgmentally selected 126 items from six 
departments that had not certified their 1994 inventories and from three 
departments that did not make any changes to their 1994 inventories. 

We could not locate 14 items, including three computers and two 
printers, with a total value of $19,173. Eleven of these items belonged 
to departments that had not certified their inventories. In addition, a 
missing typewriter and a computer terminal belonged to a department 
with only seven inventory items. This department had certified the 
inventory without making any corrections. However, when we visited 
the department, officials told us they had not seen the two missing items 
"in a while." Of the 112 items that we located, 20 were in locations 



other than the locations listed on the inventory records; six of these 
items were in different buildings. Most of these recording errors were 
from departments that had not certified their inventories. 

If the equipment at SUNY Brockport is to be adequately controlled, 
equipment managers should be aware of proper equipment procedures 
and the importance of equipment controls. A 1992 internal audit report 
issued by SUNY recommended that SUNY Brockport prepare an 
equipment procedures manual. SUNY Brockport has not complied with 
this recommendation, although they report that the manual is complete 
and awaiting approval by the Vice President for Administrative Services. 
In addition, department chairpersons have not received training on 
equipment procedures and the importance of equipment controls. We 
believe the absence of a manual and training in equipment controls may 
have contributed to the control weaknesses we identified. 

SUNY Brockport officials recognize that there are certain areas in need 
of improvement, but believe the system in place is sufficient in today’s 
environment of severely constrained budgets. We believe this decision 
should be reviewed. The equipment inventory system at SUNY 
Brockport results in unreliable information. As a result, SUNY 
Brockport managers do not have adequate information upon which to 
make informed decisions about equipment needs. 



Recommendations 

11. Improve the accuracy of the inventory records. To help bring 
about this improvement, increase the extent to which the annual 
inventories are either conducted or verified by independent 
personnel. 

12. Develop an equipment procedures manual and train equipment 
managers in equipment controls. 



Accountability for 
Equipment 



SUNY Brockport assigns administrative responsibility for equipment to 
department chairpersons. However, these persons are not held account- 
able for missing items and for complying with annual inventory 
requirements. For example: 



One department reportedly lost 105 equipment items since its last 
inventory. The missing items included about $115,000 in 
computer equipment, some purchased as recently as 1993. 
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Reporting Stolen or 
Lost Equipment 



Department officials were asked by SUNY Brockport management 
to explain how so much equipment could be lost, but they did 
not respond to this request. Nevertheless, in 1994, SUNY 
Brockport purchased about $29,000 of new computer equipment 
for this department. 

• In 1994, two other departments each reported that more than 
$40,000 worth of equipment could not be accounted for. We 
found no indication that SUNY Brockport management required 
department officials to explain how so much equipment could be 
lost. 

• Administrative action was not taken to address the fact that 17 
departments did not certify their 1994 inventories. Some of these 
departments have the largest equipment inventories on campus, 
such as the Plant Management Department, with equipment 
inventory valued at over $7 million. 

When individuals are not held accountable for equipment, they have less 

incentive to properly safeguard the equipment. 



Recommendations 

13. Require explanations for missing equipment. 

14. Investigate the equipment missing from the three departments. 

15. Take steps to ensure that departments comply with annual 
inventory requirements. 



Section 7.0200 of the New York State Accounting System User 
Procedure Manual requires the prompt reporting of all missing equipment 
to OSC. From September 30, 1992 to March 31, 1994, SUNY 
Brockport reported to OSC that 30 equipment items costing ever $19,000 
had been stolen. However, we determined that, between April 1, 1993 
and March 31, 1994, SUNY Brockport removed $190,000 of equipment 
from its records because the equipment could not be accounted for. This 
equipment also should have been reported to OSC. The full amount was 
not reported to the State Comptroller because SUNY Brockport only 
reports items that are reported to its Department of Public Safety as 
stolen. By not summarizing the equipment that caimot be accounted for 



and reporting this equipment as missing, SUNY Brockport managers 
understate the extent to which equipment is lost and stolen. 



Recommendation 

16. Report all unaccounted for equipment to the Office of the State 
Comptroller. 



Major Contributors to This Report 



David DeStefano 
Frank Houston 
Jerry Barber 
Karen Bogucki 
Donald Hespelt 
Karen Bodnar 
Michael Wrobel 
Dana Newhouse 
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October 11, 1995 



Mr. Robert H. Attmore 
Deputy Comptroller 
Office of the State Comptroller 
The State Office Building 
Albany, New York 12236 

Dear Bob; 

In accordance with Section 170 of the Executive Law, we are enclosing the comments 
of the State University of New York College at Brockport and SUNY System Administration 
regarding the draft audit report on Selected Financial Management Practices, State University 
of New York College at Brockport (95-S-32). 



Sincerely, 



Enc. 



Wniiam H. Anslow 
Senior Vice Chancellor 
forVinance and Management 
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Appendix B 



State University CoUege at Brockport Comments 



Note 



Note 



As a State agency, we have endeavored to maximize use of resources to provide efficiency in 
operations as well as quality customer service. In this effort, we have adapted principles of business 
redesign/re-engineering to develop efficient, yet effective processes that are functioning with an 
adequate system of internal controls and acceptable levels of risk.’ We believe our controls 
reasonably assure accountability and safeguarding over collection and disbursement of funds and 
equipment inventories. We realize additional improvements are needed over cash collections at 
some peripheral sites, although the College has already made substantial progress to enhance 
controls and accountability of peripheral collections. 

Page 3 

While the draft audit report states that, "...more employees than necessary have access to the 
accounting records...", there is no objective benchmark cited as to how many employees ideally 
should be granted access to the records. At Brockport we have assigned our limited staff 
responsibilities in order to provide service to our students in the most effective and controlled (in 
terms of providing reasonable safeguards of State resources) manner. Further, an audit trail exists 
for every transaction affecting student accounts. 

Page 4 

The draft audit report states; 

"SUNY Brockport officials told us that, as part of their overall efforts to improve the 
efficiency of Bursar's Office operations and better meet the needs of students, all 
Bursar’s Office employees were given the capability to change student charges. 
However, we believe that SUNY Brockport officials should periodically reevaluate 
this decision. When more employees than necessary can change charges, and some 
of these employees also handle cash, there is more likelihood that accounts can be 
improperly adjusted without detection.” 

Different levels of access were assigned so employees could only make adjustments as determined 
appropriate for their specific duties. Furthermore, our decision to extend limited charge capability 
to persons handling cash was carefully considered. Our financial management staff are advocates 
of the concepts of business re-engineering, process redesign, and quality management. We have 
assessed the impact upon student traffic flow and Bursar's Office workload in connection with the 
adjustment of minor charges. Based on extensive management experience we have concluded that 
the potential financial risk is minimal and is far outweighed by increased efficiency and productivity, 
as well as a much greater level of customer service. After appropriate consultation with upper level 
management, limited transaction capability was given to employees handling cash. 
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* See State CouiptroUyrN Note. Appwdix M2 



Pages 



The draft audit report states: 

"Accounting records must sometimes be adjusted to correct for errors. These 
adjustments must be carefully controlled to prevent unauthorized adjustments. 
Therefore, all account adjustments should be independently reviewed by 
management to ensure that they are authorized and appropriate." 

and, 

"SUNY Brockport officials told us that adjustments to the accounting records are 
summarized in a separate record and made available to independent managers. 
However, we found no documentation that these adjustments are regularly reviewed. 

As a result, unauthorized and otherwise inappropriate adjustments are less likely to 
be detected." 

As was explained to the auditors, these adjustments are regularly reviewed. However, our 
procedures did not require that individual copies of the adjustments be signed and dated on the date 
of their review. The fact of the matter is that a regular review is (and has been) performed which 
makes it almost impossible for inappropriate adjustments to go undetected. Our internal control in 
this regard is more than adequate. Nevertheless, procedures will be instituted to document evidence 
of managements review of adjustment records. 

The draft audit report states: 

"During our audit, we found th,.t cashiers in the Bursar's Office made adjustments to 
the accounting records that had the effect of reducing the amount of cash recorded 
as received without establishing corresponding accounts receivable. Until we 
brought this matter to the attention of SUNY Brockport officials, they were unaware 
of the increased control risks created by the use of this function. The officials have 
since denied the cashiers access to this computer function (which is called the 
cash-back function)." 

The cash back function was intended for use in recording cash change given back to customers upon 
receipt of payments. Cashiers were under instructions not to use the cash back function. The 
isolated mstance(s) where a cashier made adjustments were quickly discovered by the Bursar Office 
Manager during the reconciliation process and the cashier was instructed accordingly. 
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The draft audit report states: 

"At SUNY Brockport, cash disbursements can be made by any employee in the 
Bursar's Office, including the three cashiers. Moreover, all the employees in the 
Bursar's Office handle cash and have the capability to change student charges. When 
a student is due a refund or otherwise makes an overpayment, the employee who is 
acting as cashier routinely prepares the check using the check signing machine. The 
check prepared by the cashier is not reviewed by any other employee to ensure that 
the payment is appropriate." 

In response, it should be understood that an exchange transaction occurs when an amount received 
is greater than the amount due, resulting in a disbursement which is calculated by the computer. 
Refunds are prepared and reviewed/approved by two employees independent of the employee 
writing the check. The value of adding a further level of verification does not, in our opinion, 
justify the time and effort involved, considering that the customers themselves do provide a backup 
control in the event that an erroneous transaction was made to their account. 

Pa ge 7 -9 

With regard to the review of the peripheral cash collection locations, the College is aware of the 
importance of maintaining adequate cash controls. The Internal Control Officer is pursuing a 
program of meeting with department heads to individually discuss internal control matters, and 
making arrangements for a cash control training session for all cash managers in the upcoming fall 
semester. Additionally, follow-up reviews of cash collection sites by the internal review function 
continue to be conducted in accordance with review priorities assigned to all assessable units. 

Pages 10-12 

We recognize that there are certain areas in need of improvement of our equipment controls, such 
as timeliness of department equipment inventories. We feel confident that the system in place has 
worked and will continue to work for us. The findings are based on a sampling of 126 assets out of 
an inventory of over 9000 items. This amounts to less than 2 percent of the entire inventory. 

In today's environment of severely constrained budgets (and the need to do more with less while 
providing the best possible service to clients) we can ill-afiford to devote staff to activities/tasks that 
add little value to accomplishing our mission. In the competitive business environment there are 
numerous examples of highly successful organizations dramatically altering their business practices 
to streamline operations, and cut costs, to increase profitability and productivity while maintaining 
the same (or better) service to their clientele. While we don't propose that we reduce our internal 
controls, as managers we do reserve the right to make reasonable and calculated adjustments to our 
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business processes in order to balance the need to serve our students as well as safeguard State 
resources with the handing available to staff the business functions. We at Brockport believe we are 
working towards that goal and have designed our systems with the flexibility to provide reasonable 
assurances that our controls are adequate. 

Recommendations (page 51 



(OSC) 1 . Assign the capabilities to change charges only to those employees who need such 
capability to perform their duties. 



(SUCB) 1 We do grant access to our accounting, records only to those employees needing 
such access in the performance of their duties. Since all employees in the Bursar's 
Office are required to adjust accounts as part of their assigned duties, and student 
account records are maintained on computer, computer access is required. 
Additionally, different levels of access were assigned so employees could only 
make adjustments as determined appropriate for their specific duties. There are 
more than adequate safeguards in place to prevent employees from improperly 
adjusting accounting records. In the event of an unauthorized adjustment by any 
employee it would be detected by the Bursar Office manager during the daily 
reconciliation process and review of cash drawer reports which identify all 
adjustments by operator ID. Our current internal control system is effective in that 
it provides reasonable assurance that all cash received is promptly and accurately 
recorded and deposited. 



(SU) 1 . We agree with the recommendation and the College’s response. 

(OSC) 2. Minimize the number of employees who handle cash and also have the capability 

to change charges; and concurrently strengthen the independent review of account 
adjustments. 

(SUCB) 2. Based on our extensive, professional experience in the management of a student 
cashiering/receivable operation, we believe that the number of employees handling 
cash and their access to accounting records is appropriate. Employees handling 
cash only have limited ability to adjust minor charges. The decision to extend 
limited charge capability to persons handling cash was carefully considered by our 
financial management team. Our Assistant to the Vice President for Student 
Financial Services has studied the concepts of business re-engineering, process 
redesign, and quality management. He has also assessed the impact upon student 
traffic flow and Bursar's Office workload in connection with establishing 
procedures for the adjustment of minor charges. The development of our 
accounting and control systems also involved extensive input from our College 



Accountant, Assistant Vice President for Information Technology Services, 
Director of Administrative Computing, Budget Control Officer and other 
operationally knowledgeable and experienced professional staff. The conclusion 
was that any potential financial risk was extremely minimal and was more than 
offset by increased operating efficiency and enhanced customer service. After 
appropriate consultation with upper level management, the limited transaction 
capability was given to employees handling cash. Furthermore, the Bursar's Office 
has strengthened the independent review of account adjustments by generating an 
enhanced daily cash drawer report, which includes detail of all account 
adjustments by operator ID. This detailed cash drawer report is reviewed and 
utilized by the Bursar's Office Manager for daily reconciliations, and is also 
reported to the Accounting Office. 

(SU) 2. We agree vvdth the College’s response. 

(OSC) 3 . Make a record of the cash that is received in the mail as soon as the mail is opened 

and before the funds are given to the cashiers for processing. 

(SUCB) 3. Our opinion holds that a separate recording of cash received in the mail before 
funds are forwarded to cashiers for processing would not serve as a cost-effective 
or efficient control measure for our circumstances. The Bursar's Office, however, 
has eliminated the processing of mail receipts and has successfully implemented 
a lockbox system with a local bank. Mail payments are delivered from the post 
office lockbox directly to bank employees for processing and deposit of payments. 

(SU) 3. We agree with the recommendation and the College’s response. 



Recommendations fPage 6) 

(OSC) 4. Ensure that employees who make cash disbursements do not handle cash 
collections or have the capability to change student charges. 

(SUCB) 4. In order to provide appropriate customer service, we find that both disbursement 
and collection functions need to be performed by the Bursar’s Office. However, we 
have separated these functional responsibilities within this office to the extent 
possible. Cash disbursements for student refunds are initiated by department staff 
other than those performing cashiering activities. These disbursements are 
reviewed at the supervisory level and approved. Occasionally, cashiers do issue 
exchange checks for transactions they perform for customers (as would be the case 
in a commercial retail cashiering function). Exchange transactions performed by 
cashiers at the window have the check issuance amount calculated by the software 
and pre-entered on the check issuance screen. Exchange transactions are performed 
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in the presence of the customer who receives a receipt showing the amount(s) 
rendered by payment source and the exchange check amount issued. Exchange 
check transactions, which were once numerous under the Federal Family Education 
Loan Program, have virtually been eliminated since Brockport began participating 
in the Federal Direct Lending Program. Neither refund nor exchange checks can 
be issued without entering a valid student account or vendor number. These 
transactions are recorded in detail on the cash drawer report, which is utilized by 
the Office Manager daily. All disbursements are reported independently to the 
Accounting Office. Additionally, check stock and signature impressions are 
accounted for daily. We have found this process to be effective and efficient. 

(OSC) 5 . Independently review checks against supporting documentation before distributing 
the checks. 

(SUCB) 5. As described in our response to recommendation 4, we already provide reasonable 
assurance that check disbursements are authorized and appiopriately processed. 

(SU) 4,5. We agree with the recommendations and the College’s responses. 

Recommendation (Page 9 ) 

(OSC) 6. Ensure that press-numbered receipts are issued whenever cash is collected. 

(OSC) 7. Ensure that all cash deposits are reconciled to the records of cash received by 

someone independent of the cash collection function. 

(SUCB) 6,7. The timing of this audit by the Office of the State Comptroller (OSC) was initiated 

before it had issued the fmal report for a previous audit of peripheral cash 
collection locations (Audit #94-S-27). This current audit had shortly followed the 
College's decision to implement reconunendations from the prior report, and to hire 
an Internal Systems Analyst. 

Independent of any of the current audit discussions or recommendations, the 
College had already recognized the importance of enhancing cash controls and had 
taken actions to ensure uniformity and accountability of collections at peripheral 
collection sites. Administrative directives on cash controls, including the use of 
pre-numbered receipts and independent reconciliations, were distributed to campus 
cash managers as a means to address prior report recommendations. Full 
compliance with some of our internal directives and controls has not been achieved 
in some collection sites. This cannot be attributed to resistance by the departments, 
but rather the need for additional instruction and difficulties faced with staff 
shortages. The Internal Control Officer is pursuing a program of meeting with 

6 




9 



B-7 



department heads to individually discuss internal control matters, and making 
arrangements for cash control training sessions for all cash managers in the 
upcoming fall semester. Additionally, follow-up reviews of cash collection sites 
by the internal review function continue to be conducted in accordance with review 
priorities assigned to all assessable umts. 

Since the close of the recent audit (and resulting from a management initiative 
developed prior to and independent of the audit), the College has centralized 
collections at the Bursar's Office for those peripheral collections determined to be 
reasonable, including student telephone payments and parking permits and fines. 
We continue to explore possibilities to enhance automation of collection and 
receipt issuance at other peripheral collection locations. In addition, the cash 
collection locations reviewed in the audit had taken prompt action to resolve 
control weaknesses when identified in the audit report. Three of the collection sites 
have since reported that corrective actions have been implemented. One location 
is still in the process of achieving full compliance as a result of administrative 
transition, but will finalize new procedures by the start of the fall semester. 

Overall, we believe the College has made substantial progress to improve cash 
collection controls. The College will continue its efforts to evaluate and enhance 
cash controls for current and new peripheral cash collection sites. 



(OSC) 8. Deposit the examination fees into an authorized State account. 

(OSC) 9. Assure that examination fees are properly deposited and accounted for. 

(SUCB 8,9. The proceeds were deposited into an IFR account established specifically to 
account for the examination fees, and evidence of our corrective action was 
provided to the auditors before their departure. 



(OSC) 1 0. Ensure that all cash collection locations have been identified. 

(SUCB) 10. The assessment survey administered in 1 994 as part of our internal control program 
has proven to be a powerful tool in identifying peripheral cash collection sites. Not 
all campus collection sites, however, were identified at the time of the auditors 
review since several of the assessable units had not yet returned the survey. The 
draft audit failed to note that our survey of assessable units was extremely 
successful at the time of the audit field work. We had, through our routine internal 
control process, achieved a success rate of 90% in terms of survey completion as 
only 1 0 of the 98 assessable units had not returned their surveys and thus warranted 
follow-up work. The auditors had reported that four of the five locations 
examined, and three other collection locations were not identified by surveys. As 
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we informed the auditors, all of these locations, with the exception of one, had not 
returned the assessment survey for our identification. Nevertheless, the Internal 
Control Officer has updated our listing of identified collections sites, and will do 
so on a continuous basis. Any additional methods to identify peripheral cash 
collection sites will be performed, if determined to be effective by the Internal 
Control Officer. 

(SU) 6-10. We agree with the recommendations and the College’s responses. 

Recommendations (Page 111 

(OSC) 11. Improve the accuracy of inventory records. To help bring about this improvement, 
increase the extent to which the annual inventories are either conducted or verified 
by independent personnel. 

(SUCB) 1 1 . The Property Control Manager reviews the returned inventories and makes the 
determination as to which property will be independently reviewed by the Property 
Control Department. Unfortunately, staffing and time play an important role in 
determining the number of assets and the number of departments to be audited. 

We do believe that the reviews that we have conducted are of great value. The 
number of overall inspections actually conducted, thus far, although relatively 
small in number, has proven to be a great contribution to the system in increasing 
user departments awareness regarding management expectations. 

The Property Control Manager maintains a continuous dialogue with each 
department that does not return inventories by the requested due dates. Only 17 of 
127 departments had not returned their inventories by the dates requested. Fifteen 
of these departments had requested and were granted extensions, and the extended 
due dates were met. (Two reported that they had completed and forwarded their 
inventories. Photocopies have since been submitted.) The due date for the 
inventories is arbitrary. We can and do extend that date to comply with department 
requests to allow for ever-changing and varied workloads for specific departments. 

Of the 14 randomly selected items, which were not located at the time of the initial 
inspection by the auditor, seven have been since located, two of which are printers. 
Of the 20 items that were found at a location other than as indicated on the PCS, 
our records have been updated to reflect the current locations. Several of these 
items move on a continual basis (i.e., computer equipment, floor scrubbers, 
calculators). It is very difficult to know or control the exact location of the items 
at all times. 



8 




23 



B-9 



Equipment Managers have had adequate training in property control and they have 
on a continual basis contacted the Property Control Manager's office to obtain 
valuable information regarding transfers, surplus property, disposal of equipment, 
etc. 

Although an independent inventory is desirable, staffing has precluded this from 
being accomplished in the past. Current staffing levels will not allow for this level 
of effort in the future. Property Control is currently staffed by one Grade 6 
Calculations Clerk position which is supervised by the Purchasing Office. We 
would have to devote at least five full-time staff to annually inventory each of the 
9,000+ tradeable items. Furthermore, the cost of reassigning staff for the purpose 
of conducting a complete annual inventory would greatly exceed any benefit 
derived. The College has placed emphasis on our user assisted departmental 
annual reinventory process, and Property Control attempts to perform spot-check 
re-inventories as time and staffing permits. We understand the rationale for the 
recommendation pertaining to this, but believe that our alternative methods have 
proven to be successful in maintaining control of the College's inventory (with the 
exception of the few isolated instances cited in the draft audit findings). 

(OSC) 12. Develop an equipment procedures manual and train equipment managers in 
equipment controls. 

(SUCB) 12. Prior to, and independent of this current audit, we had informed SUNY that this 
was a pending item. The Property Control supervisor was charged with the 
responsibility of preparing a procedures manual. The final edition of this manual 
has been completed. This manual will be presented to the Vice President for 
Administrative Services for review and approval. It will then be circulated to all 
staff members, followed by a training session for chairs as well as directors. 

(OSC) 1 3 . Require explanations for missing equipment. 

(OSC) 14. Investigate the equipment missing from the three departments. 

(OSC) 15. Take steps to ensure that departments comply with annual inventory requirements. 

(SUCB) 13-15. Before the Property Control Department refers to items as being permanently lost 
after the initi^ inspection, we encourage departments to make every effort to 
determine what happened to the equipment (i.e., surplused, scrapped for parts, held 
in storage). The Department which reported 105 assets as being "cannot locate" 
has been in constant contact with the Property Control Manager. This department 
has since conducted a physical inspection of all of their equipment (including items 
under the $500 threshold). One of the two other cited departments has also 



conducted a physical inventory of their complete inventory. Follow-up meetings 
have been scheduled and will continue to be held with department heads whose 
inventories are returned with equipment listed as missing. 

The Property Control Office remained in contact with the departments who have 
not yet returned their inventories. We have documentation to show concerns 
raised and relevant communications explaining specifics such as, extenuating 
circumstances that interfered with timely return of inventories. The Physical Plant 
Department contacted our office to arrange for a meeting to discuss and review 
their inventory. Again, staffing and time played a role in not returning the 
inventory. 

Accountability for equipment will continue to rest with the user unit head and the 
appropriate staff. Our users have repeatedly and consistently been instructed to 
t^e appropriate measures to protect equipment and follow proper procedures for 
disposition. It would be an extremely rare occurrence for any of our staff to not 
take seriously their responsibilities regarding the stewardship of State-owned 
equipment. Our personnel are very conscientious in their care and use of 
State-owned equipment, in much the same way as they are with personally-owned 
items of value. 

With staffing reductions in some areas forcing changes in priorities, many 
departments lack the staff or time to devote to inventory. However, the Property 
Control Office plans to meet with appropriate SUNY Brockport personnel to try 
to implement an incentive program to improve compliance with inventory 
requirements. 

(OSC) 1 6. Report all unaccounted for equipment to the Office of the State Comptroller. 

(SUCB) 16. Every possible effort is made by our office to avoid retiring an asset from the 

inventory unless all measures have failed in locating the equipment. 

Historically, all lost and stolen equipment was reported to OSC. Due to a 
misinterpretation by a new supervisor, unaccountable items were not reported. 
This situation was corrected in November 1994 and all equipment that has been 
reported as "unaccountable" and retired from the PCS will be reported in a timely 
fashion to OSC. 

In 1993 the Property Control supervisor made an administrative decision to retire 
several assets from the PCS if the department reported the items as missing over 
a long period of time. It was noted that if the items were recovered the user 
department would notify Property Control immediately, and the items(s) would be 
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re-added to the PCS. This step was taken in an effort to "clean up" files that had 
included "unaccounted for equipment" for many years. 

(SU) 11-16. We agree with the recommendations and the College’s responses. 



State Comptroller’s Note 

Certain matters addressed in the draft report were revised in the final report. 
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